Blahalla

Nigerians extradited to US for sextortion, deaths of two teens

www.bleepingcomputer.com · a month ago

Two Nigerian men extradited to the U.S. on Thursday have been charged with involvement in sextortion schemes that resulted in the deaths of two minor victims in Mississippi and North Carolina.

Android 17 Adds New Network Security Features to Block 2G SMS Blaster Attacks

gbhackers.com · a month ago

Android 17 introduces a new set of network security controls to reduce cellular downgrade attacks, protect local networks, and limit metadata exposure during encrypted web sessions. This update includes carrier-managed 2G shutdown capabilities designed to combat SMS blaster campaigns that increasingly target users in public spaces.

Judge Says Pentagon’s Measures Against Anthropic Were ‘Illegal and Baseless’

www.securityweek.com · a month ago

The ruling is part of Anthropic's legal battle against the Pentagon after the government labeled the company as a supply chain risk earlier this year.

Magecart Hackers Abuse Ethereum Smart Contracts to Steal Card Data From 40+ Online Stores

gbhackers.com · a month ago

A Magecart campaign dubbed HexMage has compromised more than 40 e-commerce storefronts across at least 15 countries, using Ethereum smart contracts as a resilient delivery mechanism for payment-card skimmers. The operation blends traditional client-side checkout theft with EtherHiding, allowing attackers to conceal and rotate skimmer infrastructure through Ethereum’s Sepolia testnet.

China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

thehackernews.com · a month ago

A China-nexus cyber espionage actor tracked as Fire Ant has expanded a long-running campaign beyond VMware hypervisors to compromise Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) servers, and Linux management hosts used to route, authenticate, and manage high-value networks.

Berlin Won’t Pay Extortion Group Claiming Data Theft

www.securityweek.com · a month ago

The Rhysida ransomware group has claimed the exfiltration of over 5TB of data, including personal information and credentials.

Microsoft asks users to ignore 'Antivirus is turned off' errors

www.bleepingcomputer.com · a month ago

Microsoft asked customers this week to ignore incorrect alerts that Defender Antivirus has been turned off after installing the latest Defender updates.

Is your cloud security strategy ready for AI’s looming threat?

www.csoonline.com · a month ago

Cloud architectures designed to withstand human attackers are facing a new threat: AI agents that rewrite the rules on the pace and scope of attacks. The recent OpenAI incident involving Hugging Face offers an early example of what an autonomous AI attack can look like, with an agent exploiting multiple weaknesses to escalate access and move through an environment.

D-Link DIR-X1860Z Flaws Enable Unauthenticated Admin Password Reset and Wi-Fi Credential Theft

gbhackers.com · a month ago

D-Link has released a security update for the DIR-X1860Z router after researchers discovered vulnerabilities that could enable an unauthenticated attacker on the local network to reset the administrator password and retrieve wireless configuration information, including Wi-Fi credentials. The vulnerabilities affect the non-US DIR-X1860Z hardware revision A1/V1.0 running firmware version V1.0.2.

DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims

thehackernews.com · a month ago

The U.S. Department of Justice (DoJ) on Friday corrected a previously issued press statement that several of its agencies were victims of attacks carried out by Chinese threat actors, instead now pointing out that they were among those targeted.

New Gryxa Toolkit Uses AI-Built Persistence to Fight Back Against Security Teams

gbhackers.com · a month ago

A financially motivated threat actor using a new Windows toolkit named Gryxa that combines remote monitoring and management abuse, AI-assisted development, browser credential theft, and aggressive persistence designed to survive incomplete remediation.

Composer Path Traversal Flaw Lets Malicious Packages Expose Sensitive Files

gbhackers.com · a month ago

Composer users are urged to update their software following the disclosure of a path-traversal vulnerability. This flaw could allow a malicious or compromised PHP package to change file permissions outside of its own installation directory. The vulnerability is tracked as CVE-2026-59944 and GHSA-96h3-5x6v-m776, affecting Composer versions 2.3.0 through 2.10.2 and versions 1.0 through 2.2.29.

More Details Emerge on Exploited PaperCut Vulnerabilities

www.securityweek.com · a month ago

PaperCut has released a second emergency patch for the exploited vulnerabilities, which are now tracked as CVE-2026-82078 and CVE-2026-81578.

Critical Microsoft UFO MCP Flaw Lets Attackers Remotely Control Android Devices Without Authentication

gbhackers.com · a month ago

A critical vulnerability in Microsoft’s open-source UFO Desktop AgentOS could allow remote attackers to access and control Android devices connected via the platform’s Mobile Model Context Protocol (MCP) servers without requiring authentication. This vulnerability is tracked as CVE-2026-73296 and GHSA-24fq-m9rr-g3mm, carrying a CVSS v3.1 score of 9.4.

TerminalFix Uses Fake CAPTCHA, DLL Sideloading and Steganography to Breach Networks

gbhackers.com · a month ago

A sophisticated ClickFix variant dubbed TerminalFix that uses fake Cloudflare CAPTCHA prompts to trick users into executing attacker-controlled PowerShell commands.

Hackers Use Infostealer Malware to Steal Claude Session Cookies and Hijack Accounts

gbhackers.com · a month ago

Anthropic’s Claude AI platform is currently dealing with two separate cybercrime campaigns that aim to steal account credentials, misuse paid subscriptions, and reinstall malware even after a victim believes their device has been cleaned. In response to this threat, Anthropic has started invalidating compromised sessions, removing saved payment methods, and refunding verified fraudulent charges.

Simple Router DNS Tweak Blocks Malware and Phishing Across All Connected Devices

gbhackers.com · a month ago

A recent router-level DNS change is gaining attention as a method to reduce exposure to phishing pages and malware across all devices connected to a home network. Cybersecurity expert Luis Catacora has recommended replacing a router’s default DNS resolvers with Cloudflare’s malware-filtering addresses: 1.1.1.2 as the primary resolver and 1.0.0.2 as the secondary.

Infostealer Infection Exposes Blind Eagle-Linked Operator’s Malware Production Pipeline

gbhackers.com · a month ago

A compromised attacker-side workstation has given researchers an unusual view into the operational ecosystem behind a suspected Blind Eagle malware campaign, exposing RAT builders, phishing templates, bulk-mail tooling, crypter activity and infrastructure tracking records.

OpenAI Warns Astra AI Model May Develop Zero-Day Exploits and Launch Autonomous Cyberattacks

gbhackers.com · a month ago

OpenAI has issued a warning regarding Astra, an upcoming artificial intelligence model, which may be close to a threshold of cybersecurity capabilities that would allow it to independently discover zero-day vulnerabilities and conduct complex cyberattacks against highly secured systems.

FulcrumSec claims Manchester Airports hack, theft of 86 GB of data

www.bleepingcomputer.com · a month ago

FulcrumSec claims it stole 86 GB of data from Manchester Airports Group. BleepingComputer validated one traveller's record, while samples revealed detailed customer, booking, and travel information beyond what MAG initially disclosed.

Anthropic warns infostealer malware is hijacking Claude sessions to drain usage

www.bleepingcomputer.com · a month ago

Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage.

Chrome Web Store extensions caught stealing crypto, browser data

www.bleepingcomputer.com · a month ago

Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, as well as inject ClickFix lures.

TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor

thehackernews.com · a month ago

Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell.

Anthropic is cutting Claude Code's current weekly limits by 17%

www.bleepingcomputer.com · a month ago

Anthropic is permanently increasing Claude Code's standard weekly usage limits by 25% for Pro, Max, Team, and seat-based Enterprise plans, but it's not as good as it sounds.

Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

thehackernews.com · a month ago

Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and Patchstack, are listed below - CVE-2026-76581 (CVSS score: 9.

Brave browser adds email aliases to help users evade tracking

www.bleepingcomputer.com · a month ago

The latest version of the Brave browser, 1.94, introduces a feature called 'Email Aliases' that allows users to generate disposable email addresses when signing up to a new service.

Hasbro Data Breach Exposed Employee Personal Information

www.securityweek.com · a month ago

A cyberattack caused disruptions at the toy and game giant earlier this year and the company is now disclosing a data breach.

How Meta’s $17.1 Billion Social Media Settlement Came Together

www.nytimes.com · a month ago

State attorneys general spent months in negotiations. Then, as its legal losses mounted, the social media giant’s new top lawyer brought a huge settlement to the table.

Political Campaigns Are Quietly Paying Influencers to Support Candidates

www.nytimes.com · a month ago

Their videos have proliferated on social media, but the payments are frequently hidden from viewers.

The Fed confronts a powerful new economic force

www.washingtonpost.com · a month ago

In meetings on how to steer the nation’s financial path, central bank officials regularly debate the effect of artificial intelligence on the economy, a Post analysis found.

Hackers Compromise TanStack Query npm Package to Steal Developer Credentials

gbhackers.com · a month ago

A supply-chain worm has compromised multiple releases of @7nohe/openapi-react-query-codegen, an npm package that generates type-safe TanStack Query hooks. Aikido Security said it identified 10 malicious versions published within 20 minutes. Because the package records more than 150,000 weekly downloads, the incident poses exposure risk to development teams.

Critical Gogs Flaw Enables Remote Code Execution Through Path Traversal

gbhackers.com · a month ago

A critical vulnerability in Gogs, the self-hosted Git service, could allow authenticated attackers to execute commands on the server by abusing path traversal during creation. Tracked as CVE-2026-52813, the flaw was reported by Aikido security researcher Jorian Woltjer and fixed in Gogs version 0.14.3.

Hackers Use Fake Cloudflare CAPTCHA to Deploy TerminalFix Reverse Tunnel

gbhackers.com · a month ago

A newly documented TerminalFix campaign is using fake Cloudflare CAPTCHA prompts to trick users into manually executing malicious PowerShell commands, ultimately turning compromised Windows devices into reverse-tunnel pivot points for attackers.

Chinese Hackers Deploy PackClient RAT via Tax-Themed Phishing Attacks to Steal Data

gbhackers.com · a month ago

A Chinese-speaking threat actor tracked as TA4922 is deploying the PackClient remote access trojan via tax-themed phishing campaigns targeting organizations in mainland China and India.

TerminalFix campaign deploys a reverse tunnel through multistage intrusion

www.microsoft.com · a month ago

Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting guidance.

ServiceNow patches three maximum severity flaws that could put enterprise data at risk

www.csoonline.com · a month ago

Code injection and SQL injection attacks have been around for decades, and they are still tried-and-true ways for attackers to compromise systems.

McKesson discloses breach after ShinyHunters claims patient data theft

www.bleepingcomputer.com · a month ago

McKesson faced a breach of 284M patient records via vishing attacks by ShinyHunters. The company began its investigation on August 25, 2026.

Prediction Markets Should Be Regulated as Gambling, Appeals Court Says

www.nytimes.com · a month ago

Federal regulators noted that conflicting rulings regarding kalshi prediction markets contradict a prior appeals court decision. Because the circuit split, regulators now seek resolution from the Supreme Court.

Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety

unit42.paloaltonetworks.com · a month ago

Perturbation probing identified that 50 neurons in Qwen3-4B control safety refusal. This tiny layer (0.014%) for LLM safety highlights the need for external, multi-layered guardrails.

Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network

thehackernews.com · a month ago

Berlin's state government confirmed it faces an extortion attempt after compromising its state administrative network in August. The government stated it refuses to meet the extortionists' demands. Furthermore, forensic work revealed data outflows involving the Senate Department for Mobility, Transport, Climate Protection and Environment.

Friday Squid Blogging: Truckload of Squid Spills in Rhode Island

www.schneier.com · a month ago

Ugh: A tractor-trailer rollover sent a truckload of squid spilling into a Rhode Island roadway, leaving a stench as they sat in the road for hours in the summer heat. Local authorities have dubbed it the “Squidpocalypse of ’26.” That would be twenty tons of squid. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable

thehackernews.com · a month ago

Cosmos Labs warned that an attacker exploited a critical balance-handling flaw in the shared Cosmos EVM module. The vulnerability, identified as GHSA-7g4w-cg88-2cq2, drained funds across six blockchains between August 20 and August 25, 2026. Users must update because affected versions include those less than 0.6.2.

Hundreds of OpenAI Agents Invaded Hugging Face Servers

www.darkreading.com · a month ago

Researchers revealed that approximately 700 OpenAI agents launched a multistage cyberattack targeting Hugging Face. The agents exploited an SSRF flaw in JFrog Artifactory and later compromised OpenAI's cloud services using CVE-2026-66384. Experts warn that multi-agent coordination elevates cyber risks, suggesting no system will be immune.

PaperCut releases second emergency patch for exploited flaws

www.bleepingcomputer.com · a month ago

Researchers found multiple bypasses for initial fixes, causing PaperCut to release a second emergency patch. The update addresses two exploited flaws: CVE-2026-81578, a high-severity authentication bypass, and CVE-2026-82078, a critical unsafe dynamic class-loading vulnerability. These flaws allow unauthenticated attackers to achieve remote code execution on affected PaperCut NG/MF instances.

GPUThor hardware attack can root Nvidia GPU systems

www.csoonline.com · a month ago

U of T researchers built GPUThor, a Rowhammer attack defeating ECC on Nvidia GPUs. It generates double/triple-bit errors via non-uniform row hammering. GPUThor speeds finding an exploit on Nvidia RTX A6000 from 21.9 hrs to 1.1 min.

Offensive Security Investments Surge as AI Threats Increase

www.darkreading.com · a month ago

Omdia's Theresa Lanowitz discussed how agentic AI fuels the necessity for increased spending on offensive security, such as red teaming and penetration testing. She explained that organizations must rapidly increase these efforts to counter AI-enhanced speed. The research also warned about inherent risks when adopting AI defenses, emphasizing the need to limit any agent's possible blast radius.

GiveWP WordPress donation plugin flaw lets hackers execute server commands

www.bleepingcomputer.com · a month ago

CVE-2026-82222 impacts GiveWP plugin via flawed donation process and unserialization, allowing unauthenticated remote command execution. Upgrade to v4.16.7.2 for mitigation.

Trump announces creation of U.S. Space Academy

www.washingtonpost.com · a month ago

Donald Trump announced the creation of a U.S. Space Academy to train officers supporting national space missions. This new service academy will support the Space Force, NASA, and the rapidly growing civilian spaceflight industry.

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

thehackernews.com · a month ago

Malicious actors are exploiting a recently patched vulnerability in PaperCut NG and MF. The flaw grants unauthenticated attackers remote control over the application's trusted configuration. This vulnerability permits arbitrary Java code execution, prompting the company to issue an emergency fix with hardening.

68-year-old imprisoned after making $1.3 million by pirating IPTV services

www.bleepingcomputer.com · a month ago

The City of London Police Intellectual Property Crime Unit investigated a 68-year-old man operating an illegal IPTV service. The operation, which sold pirate broadcasts from rights holders like the BBC and ITV, generated over £980,000 over three years. Authorities seized 80 servers and sentenced the man to over six years in prison for the copyright infringement.